Reconfiguring a standalone katello capsule (smart proxy) for HA

[angry_yak_shaver]

Upgrade path scenario:

• Foreman server at 3.13.1, CentOS Stream 9.
• Have an existing katello capsule running 3.12.1. CentOS Stream 8.
• Have 2 other capsules running 3.13.1, behind a load balancer as outlined by the doc.

Am I better off doing a clean reinstall of CS9 and setup the existing host with the rest of the HA capsules or am I better off leapp-upgrade, upgrade foreman-katello software and follow the HA doc to add it to existing HA cluster?

I’m wondering about the content source settings of our existing machines. I am aware that I can do a hammer host update --name fqdn --content-source smartproxy_name - am I missing anything?

[angry_yak_shaver]

Answering my own question - from the doc:

Foreman does not support configuring existing Smart Proxy servers for load balancing. You must create a new Smart Proxy server for this purpose.

So I guess I have no choice but to start from scratch? Does anyone know why we can’t converting an existing proxy for load balancing?

[jeremylenz]

@angry_yak_shaver

I’m wondering about the content source settings of our existing machines. I am aware that I can do a hammer host update --name fqdn --content-source smartproxy_name - am I missing anything?

Updating host content source requires two steps - one on the server and one on the host. This is because sub-man configuration also needs to be updated on the host. (The hammer command would take care of only the server part.)

The easiest way to do it is thru the web UI, All Hosts > select your hosts > Change content source. That page will take you through it.

Since you are setting up a new smart proxy (as per your post above), you’ll have to run the script manually on each host. Or, you could do it a slightly roundabout way but could use the automatic REX job:

1. change content source (via web UI, covering both server and hosts), to the Foreman server itself (this will ensure you can still REX to your hosts after the old smart proxy goes down)
2. set up your new smart proxy
3. change content source (via web UI, covering both server and hosts), to the new smart proxy load balancer url

[angry_yak_shaver]

Thanks for responding @jeremylenz.

Yes I’m aware of the webUI and used it a lot however I’m not too keen to do that for more than a couple machines. I did that with ansible successfully:

community.general.ini_file backup=true path=/etc/rhsm/rhsm.conf section=server option=hostname value=capsule-lb.example.org
community.general.ini_file backup=true path=/etc/rhsm/rhsm.conf section=rhsm option=baseurl value=https://capsule-lb.example.com/pulp/content

(for ansible-console)

[angry_yak_shaver]

So is the following steps looks right to you all?

1. Point all existing hosts to new content source load balancer.
2. Delete smart proxy from /smart_proxies.
3. Reinstall existing box with el9 (Stream 9).
4. Install Foreman 3.13.1 + Katello.
5. Setup it up as part of the load-balancer.

I wonder if #2 is required.

[jeremylenz]

@angry_yak_shaver

I’m not too keen to do that for more than a couple machines.

Why not? To be clear, you don’t have to do it one host at a time. The web UI can do all your hosts at once.

If you still prefer other methods, just make sure that both server and client side steps happen: the host content_source_id must be changed on the server, the new content source must sync the same lifecycle environment assigned to the host, and the sub-man configuration must be updated on the host. Missing one of these will cause problems.

@angry_yak_shaver

Delete smart proxy from /smart_proxies.

When you have a load balanced setup, all underlying smart proxies are still expected to be “known.” So yes, delete the old one, but also set up the new one correctly (with registration_url set to the load balancer url, as per the docs.) and the new smart proxy, not the load balancer, will be visible in the UI.

[angry_yak_shaver]

@jeremylenz

Why not? To be clear, you don’t have to do it one host at a time. The web UI can do all your hosts at once.

OMG you are absolute right!

@jeremylenz

So yes, delete the old one, but also set up the new one correctly (with registration_url set to the load balancer url, as per the docs.) and the new smart proxy, not the load balancer, will be visible in the UI.

Yep have been testing that and it works. HOWEVER, since the load balancer URL is not a smart proxy instance so one cannot preset it in hostgroups nor change content source of a host to it, can we?

Can anyone give me some insight on what the --certs-cname option in foreman-installer do? I forgot to add it on one smart proxy but it seems to work fine after I re-run the command the option added - I just want to make sure it’s working as expected.

[jeremylenz]

@angry_yak_shaver

Yep have been testing that and it works. HOWEVER, since the load balancer URL is not a smart proxy instance so one cannot preset it in hostgroups nor change content source of a host to it, can we?

Correct, however, if when you create your registration command you select any one of the smart proxies behind the load balancer, the host will get configured correctly with the load balancer URL.